Candiru spyware reached devices at Al Jazeera Media Network through targeted online advertisements that required no clicks. Simply displaying a malicious ad on a selected device could trigger the attack.
Citizen Lab researchers named the technique AdFection. Their investigation linked the operation to Discover-Tech, an Israeli company that connects surveillance vendors with online advertising services.
Evidence supplied by Al Jazeera showed attacks targeting at least 45 devices during 2024 and 2025. However, that figure does not establish that every targeted device suffered a successful infection.
Malicious Ads Selected Devices Before Delivering Code
According to the researchers, Discover-Tech used its Controlium platform to help customers identify and target specific devices. Its capabilities also included device fingerprinting, profiling and identifying otherwise anonymous users.
The operation purchased advertising space through mainstream networks and exchanges. Embedded JavaScript then contacted a Discover-Tech server when a device displayed one of its ads.
Next, the server checked information such as IP addresses and advertising identifiers to determine whether the device matched the intended target.
Selected devices received additional code. Other devices received no further payload, helping the operation avoid detection while distributing ads broadly.
Because the process began when an advertisement loaded, victims did not need to click a link or interact with the ad.
Investigators Traced Traffic to Candiru Infrastructure
Al Jazeera shared network logs that allowed researchers to reconstruct the attack sequence. Connections moved from Discover-Tech infrastructure to Candiru validation servers and subsequently to spyware command-and-control servers.
Investigators also recovered a DLL file from a compromised Windows computer. They attributed it to Candiru with high confidence after comparing its code and infrastructure with previously collected samples.
Candiru sells surveillance tools, reportedly restricting sales to government customers. Its Windows malware, known as DevilsTongue, can steal files, credentials and messages.
Previous investigations have linked Candiru spyware to attacks against journalists, activists and political figures. Those operations exploited previously unknown vulnerabilities in Windows and Chrome.
Advertising Reach Extended Far Beyond Confirmed Targets
The investigation also revealed the scale of the advertising operation. Between March and June 2026, it placed approximately 3.77 billion bids and won 442 million advertising auctions.
Ads that researchers assessed as containing attacker script tags appeared across 75,373 Android and iOS apps and 120,768 websites.
However, these totals describe advertising distribution, not successful spyware infections. The targeting system could serve an ad to many devices while selecting only specific ones for additional code.
Researchers estimated that Discover-Tech advertisements directed hundreds of thousands to millions of users to associated domains. That estimate likewise does not indicate how many devices attackers compromised.
Earlier Findings Described a Similar Delivery Method
A separate investigation published in late 2025 described an advertising-based infection method associated with Predator spyware.
Known as Aladdin, that technique emerged from leaked surveillance-industry documents and marketing materials. Investigators supported those findings with technical evidence from forensic examinations.
By comparison, the AdFection investigation traced advertising infrastructure through observed attacks to Candiru spyware. The findings provide further evidence that commercial advertising systems can support highly selective surveillance operations.
Advertising Companies Blocked Accounts and Domains
Following the disclosures, several advertising organizations took action against infrastructure associated with the operation.
Google, IAB Europe, Beeswax, Eskimi and Vungle were among those that removed offending accounts or blocked related domains.
The investigation highlights how malicious advertising can expose selected users to attacks without any deliberate interaction. It also shows why the number of displayed ads must remain separate from the number of confirmed compromises.
0 responses to “Candiru Spyware Delivered Through Zero-Click Ads”